Failsafe programming of implantable medical devices

ABSTRACT

A watchdog unit receives stay-alive signals from a programming device during programming of an implantable medical device. The watchdog unit maintains a watchdog timer, and resets the timer upon receipt of each stay-alive signal. If the watchdog timer expires, the watchdog unit changes a mode of operation of the implantable device, e.g., places the implantable medical device into a known, safe state. For example, the watchdog unit may cause the implantable medical device to suspend delivery of therapy, perform a power-on reset, and/or recall a known, safe, therapy delivery program.

This application claims priority from U.S. Provisional Application Ser.No. 60/422,259, filed Oct. 31, 2002, and U.S. Provisional ApplicationSer. No. 60/503,224, filed Sep. 15, 2003. The entire content of bothProvisional Applications is incorporated herein by reference.

TECHNICAL FIELD

The invention relates to medical devices, and more particularly, toprogramming of implantable medical devices.

BACKGROUND

A variety of types of implantable medical devices are used to delivertherapies to patients. For example, implantable pulse generators areused to deliver neurostimulation and cardiac pacing therapies topatients. As another example, implantable pumps are used to delivertherapeutic agents to patients.

Typically, a clinician uses a programming device, e.g., a clinicianprogrammer, to program aspects of the operation of an implantablemedical device after it has been implanted in a patient. Programmingdevices are computing devices capable of communicating with implantablemedical devices through patient body tissue via device telemetry. Tofacilitate communication with an implantable medical device, aprogramming device may be coupled to a programming head that is placedon the surface of the patient at a position proximate to location of theimplantable medical device within the patient.

A trend in the implantable medical device arts is the ever-increasingcomplexity of the devices themselves, and the firmware that controls theoperation of the devices. For example, many modern implantable medicaldevices provide a variety of therapy delivery and/or patient monitoringmodes, which may be selected and configured by the clinician during aprogramming session. During a programming session, the clinician mayalso need to select values for a variety of programmable parameters,threshold values, or the like, that control aspects the delivery oftherapy.

Consequently, programming devices, and more particularly the softwarethat allows a clinician to select modes and/or values for programmableparameters, have become increasingly complex. Programming sessions mayinvolve trial-and-error testing of various modes and/or parametervalues. In some cases, a programming session may be automated orsemi-automated, e.g., conducted by a clinician or patient, with analgorithm executed by the programming device controlling at least someof the selection of new modes and/or parameter values to test. Suchtesting requires frequent telemetry communication between theprogramming device and the implantable medical device as new modesand/or parameters selected by the clinician, the patient, or analgorithm are communicated from the programming device to theimplantable medical device.

It is possible for the complex programming software executed byprogramming devices to have hidden failure modes that do not becomeapparent, even with extensive validation and testing. It is alsopossible for the physical cable between a programming device and atelemetry head, the telemetry head itself, or the RF telemetry linkbetween the programming device and the implantable medical device tofail. If one or more such failures occur during a programming session,e.g., during communication of a new mode or new parameter values to theimplantable medical device, the incomplete and/or inaccurate transfer ofdata may leave the implantable medical device operating in anundesirable and potentially unsafe configuration. Moreover, because ofthe failure of communication between the programming device and theimplantable medical device, a clinician may be left with no immediatemeans to remove the implantable medical device from the unsafecondition.

SUMMARY

In general, the invention is directed toward techniques for failsafeprogramming of implantable medical devices (IMDs). A watchdog unitreceives stay-alive signals from a programming device during programmingof an IMD. The watchdog unit maintains a watchdog timer, and resets thetimer upon receipt of each stay-alive signal. If the watchdog timerexpires, the watchdog unit changes a mode of operation of theimplantable device, e.g., places the implantable medical device into aknown, safe state, to avoid the IMD being left in an undesirable andpotentially unsafe state with no immediate means to remove it from sucha state. For example, the watchdog unit may cause the implantablemedical device to suspend delivery of therapy, perform a power-on reset,and/or recall a known, safe, therapy delivery program.

The watchdog unit may be located on a cable that connects theprogramming device to a telemetry head used to communicate with the IMD,may couple the cable to the telemetry head, may be located within thetelemetry head, or may be located within the IMD. Consequently, in someembodiments, the stay-alive signals may be active transitions of a dataline of the data cable, or wireless telemetry signals. The watchdog unitmay be embodied as hardware, a software module, or a combination ofhardware and software.

In one embodiment, the invention is directed to a method in whichstay-alive signals are received from a programming device during thecourse of a wireless telemetry session between the programming deviceand an IMD, and a watchdog timer is reset in response to receipt of eachof the stay-alive signals. A mode of operation of the IMD is changed inresponse to expiration of the watchdog timer.

In another embodiment, the invention is directed to a device thatincludes a telemetry circuit and a processor. The processor receivesstay-alive signals from a programming device during the course of awireless telemetry session between the programming device and an IMD,and resets a watchdog timer in response to receipt of each of thestay-alive signals. The processor sends a signal to the IMD via thetelemetry circuit to change a mode of operation of the IMD in responseto expiration of the watchdog timer.

In another embodiment, the invention is directed to an IMD that includesa telemetry circuit and a watchdog unit. The watchdog unit receivesstay-alive signals from a programming device via the telemetry circuitduring the course of a wireless telemetry session between theprogramming device and the IMD, and resets a watchdog timer in responseto receipt of each of the stay-alive signals. The watchdog unit changesa mode of operation of the IMD in response to expiration of the watchdogtimer.

In another embodiment, the invention is directed to a computer-readablemedium containing instructions. The instructions cause a programmableprocessor to receive stay alive signals from a programming device duringthe course of a wireless telemetry session between the programmingdevice and an IMD, reset a watchdog timer in response to receipt of eachof the stay-alive signals, and change a mode of operation of the IMD inresponse to expiration of the watchdog timer.

In another embodiment, the invention is directed to a method in whichprogramming signals that affect the operation of an IMD are sent to theIMD via wireless telemetry during a programming operation, andstay-alive signals are sent to a watchdog unit during the programmingoperation to allow the watchdog unit to detect failure of a wirelesstelemetry session between a programming device and the IMD during theprogramming operation.

In another embodiment, the invention is directed to a programming devicethat includes a telemetry circuit and a processor. The processor sendsprogramming signals that affect the operation of an IMD to the IMD viathe telemetry circuit during a programming operation, and sendsstay-alive signals to a watchdog unit during the programming operationto allow the watchdog unit to detect failure of a wireless telemetrysession between the programming device and the IMD during theprogramming operation.

In another embodiment, the invention is directed to a computer-readablemedium containing instructions. The instructions cause a programmableprocessor to send programming signals that affect operation of an IMD tothe IMD via wireless telemetry during a programming operation, and sendstay-alive signals to a watchdog unit during the programming operationto allow the watchdog unit to detect failure of a wireless telemetrysession between a programming device and the IMD during the programmingoperation.

The invention may provide advantages. For example, a watchdog unitaccording to the invention may quickly remove an IMD from an undesirableand unsafe state caused by a failure during programming of the IMD. Bymaintaining a watchdog timer and resetting the watchdog timer uponreceipt of stay-alive signals, a watchdog unit according to theinvention may detect hardware or software failures of the programmingdevice, and failure of the cable that couples the programming device tothe telemetry head. In embodiments where the watchdog unit is locatedwithin the IMD, which are preferred, the watchdog unit may additionallydetect failure of the telemetry head, the radio-frequency telemetryconnection between the telemetry head and the IMD, and telemetrycircuitry of the IMD. However, embodiments wherein the watchdog unit islocated outside the IMD may advantageously be used during programming ofexisting IMDs.

The details of one or more embodiments of the invention are set forth inthe accompanying drawings and the description below. Other features,objects, and advantages of the invention will be apparent from thedescription and drawings, and from the claims.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a conceptual diagram illustrating a system in which an exampleimplantable medical device is programmed using failsafe programmingtechniques according to the invention.

FIG. 2 is a block diagram further illustrating the system of FIG. 1according to an embodiment of the invention in which the system includesa watchdog unit that facilitates failsafe programming of the implantablemedical device of FIG. 1.

FIG. 3 is a block diagram further illustrating the watchdog unit of FIG.2 according to an embodiment of the invention.

FIG. 4 is a block diagram illustrating the implantable medical device ofFIG. 1 according to an embodiment of the invention in which theimplantable medical device includes a watchdog unit.

FIG. 5 is a block diagram illustrating an exemplary programming devicethat facilitates failsafe programming of the implantable medical deviceof FIG. 1.

FIG. 6 is a flow diagram illustrating exemplary operation of theprogramming device of FIG. 5 to facilitate failsafe programming of theimplantable medical of FIG. 1.

FIG. 7 is a flow diagram illustrating exemplary operation of thewatchdog unit of FIG. 3 to facilitate failsafe programming of theimplantable medical device of FIG. 1.

DETAILED DESCRIPTION

FIG. 1 is a conceptual diagram illustrating a system 10 in which anexample implantable medical device (IMD) 12 is programmed using failsafeprogramming techniques according to the invention. IMD 12 is shown inFIG. 1 implanted within a patient 14. In the illustrated embodiment, IMD12 takes the form of an implantable neurostimulator (INS) that deliversneurostimulation therapy to patient 12 via leads 16A and 16B(hereinafter “leads 16”).

Specifically, in the illustrated configuration, leads 16 are implantedproximate to the spinal cord 18 of patient 14, and IMD 12 deliversspinal cord stimulation (SCS) therapy to patient 14 in order to, forexample, reduce pain experienced by patient 14. Leads 16 includeelectrodes (not shown in FIG. 1), and IMD 12 delivers neurostimulationto spinal cord 18 via the electrodes. IMD 12 may be an implantable pulsegenerator, and may deliver neurostimulation to spinal cord 18 in theform of electrical pulses.

IMD 12 delivers neurostimulation according to a program. The program mayinclude values for a number of parameters, and the parameter valuesdefine the neurostimulation therapy delivered according to that program.In embodiments where IMD 12 delivers neurostimulation therapy in theform of electrical pulses, the parameters may include voltage or currentpulse amplitudes, pulse widths, pulse rates, and the like. Further, theparameters for a program include information identifying whichelectrodes have been selected for delivery of pulses according to theprogram, and the polarities of the selected electrodes.

System 10 also includes a programming device 20. Programming device 20may, as shown in FIG. 1, be a handheld computing device. Programmingdevice 20 includes a display 22, such as a LCD or LED display, todisplay information to a user. Programming device 20 may also include akeypad 24, which may be used by a user to interact with programmingdevice 20. In some embodiments, display 22 may be a touch screendisplay, and a user may interact with programming device 20 via display22. A user may additionally or alternatively interact with clinicianprogrammer 20 using peripheral pointing devices, such as a stylus ormouse. Keypad 24 may take the form of an alphanumeric keypad or areduced set of keys associated with particular functions.

A clinician (not shown) may use programming device 20 to programneurostimulation therapy for patient 12. In some embodiments, theclinician specifies programs by selecting program parameter values, andtests the specified programs on patient 12. In other embodiments,programming device 20 provides an automated or semi-automatedprogramming routine in which programming device 20 generates programsand tests the generated programs on patients. In such embodiments,either or both of the clinician and patient 14 may interact withprogramming device 20 during testing of the generated programs. Further,in such embodiments, the clinician may interact with programming device20 to confirm programs generated by programming device 20 for testing,and/or to select programs from among those automatically tested byprogramming device. An exemplary programming device that provides asemi-automated programming routine is described in U.S. Pat. No.6,308,102, issued to Sieracki et al.

In either case, programming device 20 sends each of the programs to betested to IMD 12 using radio-frequency telemetry techniques known in theart. For example, programming device 20 may send program parameters ascommands, and may send other commands necessary to effect reprogrammingof IMD 12 via device telemetry. IMD 12 receives and decodes thecommands, and stores the program parameters in registers, or the like,for use in defining the neurostimulation delivered to patient 14according to that program. Programming device 20 is coupled to atelemetry head 26 via cable 28, and head 26 is placed in proximity toIMD 12 to facilitate telemetry communication between programming device20 and IMD 12.

Programming device 20 sends a number of commands to IMD 12 to reprogramIMD 12 for each program tested during the programming session. Inconventional systems, if IMD 12, cable 28, or telemetry head 26 were tofail during the transmission of commands necessary to reprogram IMD 12for testing of a program, IMD 12 could be left in an undesirable orpotentially dangerous state, e.g., could deliver undesirable orpotentially dangerous neurostimulation according to an incompleteprogram. Moreover, in conventional systems, because IMD 12, cable 28, orhead 26 had failed, the clinician and/or patient 14 might be left withno immediate means to remove IMD 12 from the undesirable or potentiallydangerous state.

System 10, in accordance with the invention, includes a watchdog unit(not shown). The watchdog unit and programming device 20 provide forfailsafe programming of IMD 12, as will be described in greater detailbelow. The watchdog unit may be embodied as a hardware device, as asoftware algorithm stored within a computer-readable medium and executedby a processor, or as a combination of hardware and software.

The watchdog unit may be located, for example, within telemetry head 26or along cable 28. In some embodiments, the watchdog unit may couplecable 28 to head 26. In other embodiments, the watchdog unit is locatedwithin or provided by IMD 12.

FIG. 2 is a block diagram further illustrating system 10 according to anembodiment of the invention. As discussed above, system 10 includes IMD12, and programming device 20 coupled to telemetry head 26 by cable 28.System 10 further includes a watchdog unit 40, which in the illustratedembodiment couples cable 28 to head 26.

During a programming session, watchdog unit 40 maintains a watchdogtimer. Programming device 20 sends stay-alive signals to watchdog unit40 via cable 28 to indicate that programming device 20 is functioningproperly, and watchdog unit 40 resets the watchdog timer in response toeach of the stay-alive signals. In the event that watchdog unit 40 failsto receive a stay-alive signal before the watchdog timer expires,watchdog unit 40 sends one or more commands to IMD 12 via telemetry head26 to change a mode of operation of IMD 12, e.g., to place IMD 12 in aknown, safe state.

For example, watchdog unit 40 may send a command to INM 12 to cause IMD12 to stop delivering therapy and/or perform a power-on reset (POR). Insome embodiments, watchdog unit 40 or IMD 12 stores a known, safeneurostimulation therapy program. In such embodiments, watchdog unit 40may provide the program to IMD 12, or send a command to IMD 12 to causeIMD 12 to recall the program for delivery of neurostimulation therapyaccording to the program.

Programming device 20 sends a stay-alive signal to watchdog unit 40periodically such that watchdog unit 40 receives a stay-alive signalbefore the watchdog timer expires. In exemplary embodiments, thestay-alive signals comprise transitions on one or more data lines ofcable 28 that couple programming device 20 to watchdog unit 40. Byrequiring stay-alive signals to be active transitions on one or moredata lines rather than passive hardware handshaking lines, watchdog unit40 may avoid erroneously resetting the watchdog timer in situationswhere programming device 20 has failed but continues to generate thepassive signal, e.g. the signal is “locked in” by failure of programmingdevice 20. Programming device 20 may provide stay-alive signals uponexecution of instructions of control software of programming device 20that is used for transmission of programming commands to IMD 12, ratherthan as part of an independent thread or process, so that programmingdevice 20 does not continue to signal that it is operating properlydespite the fact that the control software has failed.

Watchdog unit 40 receives signals, e.g., programming commands, fromprogramming device 20 via cable 28 during a programming operation, e.g.,a reprogramming of IMD 12 with a new program to test during aprogramming session, that are provided to telemetry head 26 fortransmission to IMD 12. In exemplary embodiments, the signals aretransitions on one or more data lines of cable 28 that coupleprogramming device 20 to watchdog unit 40. In some embodiments, watchdogunit 40 resets the watchdog timer upon receipt of both programmingsignals and stay-alive signals, and programming device 20 providesdedicated stay-alive signals such that watchdog unit 40 receives eithera programming signal or stay-alive signal before the watchdog timerexpires. Programming device 20 may send programming signals andstay-alive signals on common or separate data lines of cable 28.

As described above, a programming session may include multipleprogramming operations, e.g., IMD 12 may be reprogrammed a number oftimes to test a number of programs. Further, the programming session mayinclude a period between programming operations where non-criticalcommunication, or no communication, between programming device 20 andIMD 12 is taking place. In order to avoid delivery of stay-alive signalsand maintenance of the watchdog timer during periods between programmingoperations, e.g., non-critical periods, programming device 20 may onlydeliver stay-alive signals during programming operations, and may signalthe beginnings and ends of programming operations to watchdog unit 40 tocause watchdog unit to maintain the watchdog timer only during theprogramming operations.

As described above, watchdog unit 40 maintains the watchdog timer todetect hardware or software failures of programming device 20, and placeIMD 12 in a safe state in response to such a failure. Further, becausethe watchdog timer will also expire if cable 28 fails, watchdog unit 40will detect a failure of cable 28, and place IMD 12 in a safe state inresponse to such a failure.

FIG. 3 is a block diagram further illustrating watchdog unit 40according to an embodiment of the invention. As illustrated in FIG. 3,watchdog unit 40 includes a processor 50 that controls watchdog unit 40to provide the functionality attributed to watchdog unit 40 herein.Processor 50 maintains the watchdog timer as described above, andreceives programming signals and stay-alive signals from programmingdevice 20 via one or more data lines of cable 28.

Watchdog unit 40 may include a telemetry circuit 52 that enablescommunication between watchdog unit 40 and IMD 12 (FIG. 1). Uponexpiration of the watchdog timer, processor 50 sends a command to IMD 12via telemetry circuit 52 and telemetry head 26 (FIG. 1) to change a modeof operation of IMD 12, e.g., to place IMD 12 in a known, safe state. Asdescribed above, the command may cause IMD 12 to suspend delivery oftherapy, perform a POR, and/or recall a stored program. In someembodiments, upon expiration of the watchdog timer, processor 50 sends aprogram stored in a memory 54 to IMD 12 via telemetry circuit 52 andhead 26 to cause IMD 12 to deliver therapy according to the program.During “normal” operation, e.g., when the watchdog timer has notexpired, processor 50 sends programming signals received fromprogramming device 20 to IMD 12 via telemetry head 26.

In exemplary embodiments, watchdog unit 40 receives power for operationfrom programming device 20 via cable 28. In such embodiments, watchdogunit 40 may also include an auxiliary power source 56. In the event thatprocessor 50 detects a failure in the delivery of power from programmingdevice 20, which may be caused by a hardware failure of device 20 or afailure of cable 28, processor 50 may activate auxiliary power source 56and send a command to IMD 12 via telemetry circuit 54 to change a modeof operation of IMD 12.

Auxiliary power source 56 may be, for example, a rechargeable battery orcapacitive element. In some embodiments, auxiliary power source 56 needonly store enough power to allow processor 50 to send a command to IMD12 to place IMD 12 in a known, safe state. Further, the invention is notlimited to embodiments where watchdog unit 40 receives primary powerfrom programming device 20, but instead includes embodiments wherewatchdog unit 40 houses a primary power source, such as a rechargeableor non-rechargeable battery.

In some embodiments, watchdog unit 40 provides an emergency shutdowncircuit 58, which may be activated by a user, such as the clinician orpatient 14 (FIG. 1). Upon activation of emergency shutdown circuit 58,processor 50 sends a command to IMD 12 via telemetry circuit 52 to causeIMD 12 to, for example, suspend delivery of therapy. Emergency shutdowncircuit 58 may include, for example, a switch that is activated by theuser pressing a button located on a housing of watchdog unit 40.

Processor 50 may include one or more of a microprocessor, a controller,a digital signal processor (DSP), an application specific integratedcircuit (ASIC), a field-programmable gate array (FPGA), discrete logiccircuitry, or the like. Memory 54 may store program instructions thatcause processor 50 to provide the functionality ascribed to it herein.Memory 54 may include one or more volatile, non-volatile, magnetic,optical, or electrical media, such as read-only memory (ROM), randomaccess memory (RAM), electrically-erasable programmable ROM (EEPROM),non-volatile RAM (NVRAM), flash memory, or the like. Memory 54 mayinclude both on-board and off-board components.

FIG. 4 is a block diagram illustrating IMD 12 according to an embodimentof the invention in which IMD 12 includes a watchdog unit 60. Likewatchdog unit 40, watchdog unit 60 receives stay-alive signals fromprogramming device 20, resets a watchdog timer in response to receipt ofstay-alive signals, and changes a mode of operation of IMD 12 inresponse to expiration of the watchdog timer. Watchdog unit 60 locatedwithin IMD 12 may detect failure of telemetry head 26 (FIG. 1), loss ofthe RF telemetry link between programming device 20 and IMD 12, andfailure of a telemetry circuit 62 of IMD 12 in addition to hardware orsoftware failures of programming device 20 and failure of cable 28 (FIG.1).

IMD 12 delivers neurostimulation therapy via electrodes 64A-D of lead16A and electrodes 64E-H of lead 16B (collectively “electrodes 64”).Electrodes 64 may be ring electrodes. The configuration, type and numberof electrodes 64 illustrated in FIG. 2 are merely exemplary.

Electrodes 64 are electrically coupled to a therapy delivery circuit 66via leads 16. Therapy delivery circuit 66 may, for example, include oneor more output pulse generators, e.g., capacitive elements and switches,coupled to a power source such as a battery. Therapy delivery circuit 66delivers electrical pulses to patient 14 via two or more of electrodes64 under the control of a processor 68.

As described above, processor 68 controls therapy delivery circuit 66 todeliver neurostimulation therapy according to a program. Specifically,processor 68 may control circuit 66 to deliver electrical pulses withthe amplitudes and widths, and at the rates specified by the program.Processor 68 may also control circuit 66 to deliver the pulses via aselected combination of electrodes 64, as specified by the program.

As described above, IMD 12 may be reprogrammed a number of times duringa programming session to test a number of programs. For each programtested, IMD 12 receives a number of commands, including the programparameters, from programming device 20 via telemetry circuit 62 andwatchdog unit 60. The program parameters are stored within a memory 70as the program used by processor 68 to control delivery ofneurostimulation.

Programming device 20 also sends stay-alive signals via RF devicetelemetry, which are received by watchdog unit 60 via telemetry circuit62. Watchdog unit 60 may reset the watchdog timer upon receipt of eachstay-alive signal, and may also reset the watchdog timer upon receipt ofprogramming commands from programming device 20. In some embodiments,watchdog unit 60 also receives signals indicating the beginning andending of a programming operation from programming device 20, andmaintains the watchdog timer only during the indicated programmingoperations.

Watchdog unit 60 changes a mode of operation of IMD 12, e.g., places IMD12 into a known safe state, upon expiration of the watchdog timer.Watchdog unit 60 may, for example, cause IMD 12 to suspend delivery oftherapy, perform a POR, and/or activate a known, safe program stored inmemory 70. The functionality attributed to watchdog unit 60 herein maybe provided by processor 68, or by a separate processor. Where watchdogunit 60 is embodied within a separate processor, watchdog unit 60 maysignal expiration of the watchdog timer to processor 68 to causeprocessor 68 to change a mode of operation of IMD 12 in any of theabove-identified ways.

Processor 68 and watchdog unit 60 may include one or more of amicroprocessor, a controller, a DSP, an ASIC, an FPGA, discrete logiccircuitry, or the like. Memory 70 may include program instructions that,when executed by processor 68 and watchdog unit 60, cause processor 68and watchdog unit 60 to perform the functions ascribed to processor 68and watchdog unit 60 herein. Memory 70 may include one or more volatile,non-volatile, magnetic, optical, or electrical media, such as RAM, ROM,NVRAM, EEPROM, flash memory, and the like. Memory 70 may includeon-board and/or off-board components.

FIG. 5 is a block diagram illustrating programming device 20 in greaterdetail. Programming device 20 includes a processor 80 and a userinterface 82 that allows a user, such as the clinician or patient 14, tointeract with processor 80. User interface 82 may include display 22 andkeypad 24 (FIG. 1), and allow the user to, for example, select programsto test during a programming session.

Processor 80 may transmit programming signals, e.g., commands, to IMD 12via a telemetry circuit 84 and telemetry head 26 (FIG. 1). Processor 80also provides stay-alive signals to a watchdog unit 40 via a data lineof cable 28 (FIG. 1), or to a watchdog unit 60 via telemetry circuit 84and telemetry head 26, as described above. Processor 80 sends thestay-alive signals periodically, such that the watchdog unit 40, 60receives a stay-alive signal before the watchdog timer expires.

In some embodiments, as described above, the watchdog unit 40, 60 resetsthe watchdog timer upon receipt of both programming signals andstay-alive signals, and processor 80 provides dedicated stay-alivesignals such that the watchdog unit 40, 60 receives with a programmingsignal or stay-alive signal before the watchdog timer expires. Inexemplary embodiments, processor 80 provides stay-alive signals uponexecution of instructions of control software of programming device 20.Further, in order to avoid delivery of stay-alive signals during periodwhere there is no communication or non-critical communication with IMD12, processor 80 may send signals to the watchdog unit 40, 60 indicatingthe beginning and end of programming operations within a programmingsession, and may send stay-alive signals only during the programmingoperations.

Processor 80 may include a microprocessor, a controller, a DSP, an ASIC,an FPGA, discrete logic circuitry, or the like. A memory 86 may includeprogram instructions that, when executed by processor 80, causeprogramming device 20 to perform the functions ascribed to programmingdevice 20 herein. Memory 86 may include any volatile, non-volatile,fixed, removable, magnetic, optical, or electrical media, such as a RAM,ROM, CD-ROM, hard disk, removable magnetic disk, memory cards or sticks,NVRAM, EEPROM, flash memory, and the like.

FIG. 6 is a flow diagram illustrating exemplary operation of programmingdevice 20 to facilitate failsafe programming of IMD 12. Programmingdevice 20 sends a signal indicating the beginning of a programmingoperation to a watchdog unit 40, 60 (90). During the programmingoperation, programming device 20 periodically sends stay-alive signalsto the watchdog unit 40, 60 to cause the watchdog unit to reset awatchdog timer (92). In some embodiments, programming device 20 may onlysend dedicated stay-alive signals when no programming signal has beensent in time to cause the watchdog unit 40, 60 to reset the watchdogtimer. When programming device 20 determines that the programmingoperation is done (94), programming device 20 sends a signal to thewatchdog unit 40, 60 indicating the end of the programming operation(96).

FIG. 7 is a flow diagram illustrating exemplary operation of watchdogunit 40 to facilitate failsafe programming of IMD 12. Although FIG. 7illustrates operation of watchdog unit 40, it is understood thatwatchdog unit 60, as described above, may perform many of the functionsof watchdog unit 40.

Watchdog unit 40 receives a signal indicating the start of a programmingoperation from programming device 20 via one or more data lines of cable28 (100), and initializes a watchdog timer in response to the signal(102). Watchdog unit 40 monitors for failure of power delivery fromprogramming device 20 (104), activation of an emergency shutdown circuit58 by a user (106), a signal indicating the end of the programmingoperation from programming device 20 (108), and stay-alive signals fromprogramming device 20 (110) during the programming operation. Each timewatchdog unit 40 receives a stay-alive signal, and in some embodiments aprogramming signal, from programming device 20 before the watchdog timerexpires, watchdog unit 40 resets the watchdog timer (112).

If watchdog unit 40 does not receive a stay-alive signal or programmingsignal from programming device 20 before the watchdog timer expires(110), watchdog unit sends a signal to IMD 12 via telemetry head 26 toplace IMD 12 in a known, safe state (116). The signal may cause IMD 12to, for example, suspend delivery of therapy, perform a POR, and/orrecall a known, safe therapy program. Watchdog unit 40 also sends such asignal to IMD 12 (126) if a user activates the emergency shutdowncircuit 58 (106). In embodiments wherein watchdog unit 40 receivesprimary power from programming device 20, watchdog unit 40 activates anauxiliary power source 56 (114) and sends the signal to IMD 12 (116)upon detection of a failure of power delivery by programming device 20(104). When watchdog unit 40 receives a signal from programming device20 indicating the end of the programming operation (108), watchdog unit40 may stop maintaining the watchdog timer.

Various embodiments of the invention have been described. However, oneskilled in the art will recognize the various modifications may be madeto the described embodiments without departing from the scope of theinvention. For example, the invention is not limited to programming ofspinal cord stimulation (SCS) therapy, or even to programming ofneurostimulation therapy. The failsafe programming techniques describedherein may be applied to the programming of any implantable medicaldevice, such as pacemakers and implantable pumps. Moreover, theinvention is not limited to failsafe programming of implantable medicaldevices that deliver therapy, but may include failsafe programming ofimplantable medical devices used to monitor patients, such asimplantable hemodynamic monitors or loop recorders.

Further, although a programming device has been described hereinprimarily as a clinician programmer used to program therapy during aprogramming session, the invention is not so limited. A programmingdevice that facilitates failsafe programming of an implantable medicaldevice may a patient programmer used to control delivery of therapy byan implanted medical device in an ambulatory setting. For example, apatient programmer may be used to adjust program parameter for deliveryof neurostimulation by an implantable medical device. These and otherembodiments are within the scope of the following claims.

1. A method comprising: receiving programming signals and stay-alivesignals from a programming device at a watchdog unit coupled to theprogramming device during a programming session between the programmingdevice and an implantable medical device; resetting a watchdog timermaintained by the watchdog unit in response to receipt of each of theprogramming signals and the stay-alive signals; and sending a signalfrom the watchdog unit to the implantable medical device via wirelesstelemetry to change a mode of operation of the implantable medicaldevice in response to expiration of the watchdog timer.
 2. The method ofclaim 1, wherein the watchdog unit is coupled to the programming deviceby a cable, and receiving programming signals and slay-alive signalscomprises detecting transitions on a data line of the cable.
 3. Themethod of claim 1, wherein sending a signal to the implantable medicaldevice comprises directing the implantable medical device to suspenddelivery of therapy.
 4. The method of claim 1, wherein sending a signalto the implantable medical device comprises directing the implantablemedical device to perform a power-on reset.
 5. The method of claim 1,wherein sending a signal to the implantable medical device comprisesproviding a program to the implantable medical device, the programcontrolling delivery of therapy by the implantable medical device. 6.The method of claim 1, wherein sending a signal to the implantablemedical device includes causing the implantable medical device to revertto a program previously stored within a memory of the implantablemedical device.
 7. The method of claim 1, further comprising: receivinga signal from the programming device at the watchdog unit that indicatesinitiation of a programming operation; and initializing the watchdogtimer in response to the signal.
 8. The method of claim 1, furthercomprising: receiving power at the watchdog unit from the programmingdevice; detecting a failure of power delivery by the programming device;activating an auxiliary power source of the watchdog unit in response tothe detection; and sending a signal from the watchdog unit to theimplantable medical device via wireless telemetry to change the mode ofoperation of the implantable medical device in response to thedetection.
 9. The method of claim 1, further comprising: receiving anemergency-off signal from a user at the watchdog unit; and sending asignal from the watchdog unit to the implantable medical device viawireless telemetry to change the mode of operation of the implantablemedical device in response to receipt of the signal.
 10. A watchdog unitcomprising: a telemetry circuit; and a processor to receive programmingsignals and stay-alive signals from a programming device coupled to thewatchdog unit during a programming session between the programmingdevice and an implantable medical device, reset a watchdog timer inresponse to receipt of each of the programming signals and thestay-alive signals, and send a signal to the implantable medical devicevia the telemetry circuit to change a mode of operation of theimplantable medical device in response to expiration of the watchdogtimer.
 11. The watchdog unit of claim 10, wherein the processor iscoupled to a data line of a cable, and the processor receivesprogramming signals and stay-alive signals by detecting transitions onthe data line.
 12. The watchdog unit of claim 10, wherein the signalcauses the implantable medical device to suspend delivery of therapy.13. The watchdog unit of claim 10, wherein the signal causes theimplantable medical device to perform a power-on reset.
 14. The watchdogunit of claim 10, further comprising a memory to store a program thatcontrols delivery of therapy by the implantable medical device, whereinthe processor changes the mode of operation of the implantable medicaldevice by providing the program to the implantable medical device viathe telemetry circuit.
 15. The watchdog unit of claim 10, wherein thesignal causes the implantable medical device to revert to a programpreviously stored within a memory of the implantable medical device. 16.The watchdog unit of claim 10, wherein the processor receives a signalfrom the programming device that indicates initiation of a programmingoperation, and initializes the watchdog timer in response to the signal.17. The watchdog unit of claim 10, wherein the watchdog unit receivespower from the programming device, the watchdog unit further comprisingan auxiliary power source, and wherein the processor detects a failureof power delivery by the programming device, activates the auxiliarypower source in response to the detection, and sends a signal to theimplantable medical device via the telemetry circuit to change the modeof operation of the implantable medical device in response to thedetection.
 18. The watchdog unit of claim 10, further comprising a userinterface, wherein the processor receives an emergency-off signal inresponse to interaction of a user with the user interface, and sends asignal to the implantable medical device via the telemetry circuit tochange the mode of operation of the implantable medical device inresponse to receipt of the signal.
 19. The watchdog unit of claim 10,wherein the programming device is coupled to a programming head by acable, and the watchdog unit is located within the programming head. 20.The watchdog unit of claim 10, wherein the programming device is coupledto a programming head by a cable, and watchdog unit couples the cable tothe programming head.
 21. A computer-readable medium comprisinginstructions that cause a programmable processor to: receive programmingsignals and stay-alive signals at a watchdog unit coupled to aprogramming device from the programming device during a programmingsession between the programming device and an implantable medicaldevice; reset a watchdog timer maintained by the watchdog unit inresponse to receipt of each of the programming signals and thestay-alive signals; and send a signal from the watchdog unit to theimplantable medical device via wireless telemetry to change a mode ofoperation of the implantable medical device in response to expiration ofthe watchdog timer.
 22. The computer-readable medium of claim 21,wherein the instructions that cause a programmable processor to send asignal to the implantable medical device comprise instructions thatcause a programmable processor to direct the implantable medical deviceto suspend delivery of therapy.
 23. The computer-readable medium ofclaim 21, wherein the instructions that cause a programmable processorto send a signal to the implantable medical device comprise instructionsthat cause a programmable processor to direct the implantable medicaldevice to perform a power-on reset.
 24. The computer-readable medium ofclaim 21, wherein the instructions that cause a programmable processorto send a signal to the implantable medical device comprise instructionsthat cause a programmable processor to provide a program to theimplantable medical device, the program controlling delivery of therapyby the implantable medical device.
 25. The computer-readable medium ofclaim 21, wherein the instructions that cause a programmable processorto send a signal to the implantable medical device comprise instructionsthat cause a programmable processor to direct the implantable medicaldevice to revert to a program previously stored within a memory of theimplantable medical device.
 26. The computer-readable medium of claim21, further comprising instructions that cause a programmable processorto; receive a signal at the watchdog unit from the programming devicethat indicates initiation of a programming operation; and initialize thewatchdog timer in response to the signal.
 27. The computer-readablemedium of claim 21, further comprising instructions that cause aprogrammable processor to: detect a failure of power delivery by theprogramming device; activate an auxiliary power source of the watchdogunit in response to the detection; and send a signal from the watchdogunit to the implantable medical device via wireless telemetry to changethe mode of operation of the implantable medical device in response tothe detection.
 28. The computer-readable medium of claim 21, furthercomprising instructions that cause a programmable processor to: receivean emergency-off signal from a user at the watchdog unit; and send asignal from the watchdog unit to the implantable medical device viawireless telemetry to change the mode of operation of the implantablemedical device in response to the signal.
 29. A system comprising: aprogramming device; an implantable medical device; and a watchdog unitcoupled to the programming device to receive programming signals andstay-alive signals from the programming device during a programmingsession between the programming device and the implantable medicaldevice, reset a watchdog timer maintained by the watchdog unit inresponse to receipt of each of the programming signals and thestay-alive signals, and send a signal from the watchdog unit to theimplantable medical device via wireless telemetry to change a mode ofoperation of the implantable medical device in response to expiration ofthe watchdog timer.
 30. The system of claim 29, wherein the implantablemedical device comprises a memory to store a program that controlsdelivery of therapy by the implantable medical device, wherein thewatchdog unit causes the implantable medical device to delivery therapyaccording to the program in response to expiration of the watchdogtimer.
 31. The system of claim 29, wherein the watchdog unit receives asignal from the programming device that indicates initiation of aprogramming operation, and initializes the watchdog timer in response tothe signal.
 32. The system of claim 29, wherein the implantable medicaldevice comprises an implantable neurostimulator.